diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md index fc2afaf..08b40c5 100644 --- a/.github/PULL_REQUEST_TEMPLATE.md +++ b/.github/PULL_REQUEST_TEMPLATE.md @@ -8,8 +8,13 @@ title: '' ## Test plan +## Security & Dependencies +- [ ] Any new or updated dependencies have been reviewed for supply-chain risk. + ## Checklist - [ ] `cargo fmt --check` passes - [ ] `cargo clippy -D warnings` passes - [ ] `cargo test` passes +- [ ] `cargo audit` passes +- [ ] `cargo deny check` passes diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml new file mode 100644 index 0000000..489cf33 --- /dev/null +++ b/.github/workflows/audit.yml @@ -0,0 +1,50 @@ +name: Security & Dependency Audit + +on: + push: + branches: + - main + - develop + pull_request: + branches: + - main + - develop + types: + - opened + - synchronize + - reopened + schedule: + - cron: '0 0 * * 0' + +jobs: + audit: + name: Dependency Audit & Policy Check + runs-on: ubuntu-latest + + defaults: + run: + working-directory: ./contracts + + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + - name: Set up Rust toolchain + uses: dtolnay/rust-toolchain@stable + + - name: Cache Cargo build artifacts + uses: Swatinem/rust-cache@v2 + with: + cache-on-failure: true + workspaces: "./contracts" + + - name: Install cargo-audit and cargo-deny + uses: taiki-e/install-action@v2 + with: + tool: cargo-audit,cargo-deny + + - name: Run cargo audit + run: cargo audit + + - name: Run cargo deny check + run: cargo deny check diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 0fc2269..c9c7f23 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -6,6 +6,9 @@ on: - main - develop pull_request: + branches: + - main + - develop types: - opened - synchronize @@ -15,7 +18,7 @@ jobs: ci: name: Rust CI runs-on: ubuntu-latest - + defaults: run: working-directory: ./contracts @@ -28,7 +31,7 @@ jobs: uses: dtolnay/rust-toolchain@stable with: components: rustfmt, clippy - targets: wasm32-unknown-unknown, wasm32v1-none + targets: wasm32-unknown-unknown - name: Cache cargo build artifacts uses: Swatinem/rust-cache@v2 @@ -37,7 +40,10 @@ jobs: workspaces: "./contracts" - name: Install Stellar CLI - uses: stellar/stellar-cli@v23.0.1 + run: | + wget -q https://github.com/stellar/stellar-cli/releases/download/v23.0.1/stellar-cli-x86_64-unknown-linux-gnu.tar.gz + tar -xzf stellar-cli-x86_64-unknown-linux-gnu.tar.gz + sudo mv stellar /usr/local/bin/ - name: Check formatting run: cargo fmt --all -- --check diff --git a/Cargo.toml b/Cargo.toml index f278591..dd9c8ec 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -11,6 +11,7 @@ resolver = "2" [workspace.dependencies] soroban-sdk = "23" +ethnum = "1.5.3" [profile.release] overflow-checks = true diff --git a/SECURITY.md b/SECURITY.md index 640d109..15493e9 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,5 +1,18 @@ # Security Policy +## Reporting Vulnerabilities + +If you discover a potential security vulnerability within Orivex smart contracts or dependencies, please do NOT open a public issue. + +Report security vulnerabilities via private disclosure to the Orivex maintainers. + +## Dependency Security & CI Audits + +Orivex enforces automated supply-chain dependency audits in CI: +- **`cargo-audit`**: Checks dependencies against the RustSec vulnerability database. +- **`cargo-deny`**: Enforces license compliance, source integrity, and advisory bans. + +For detailed security policy and local audit execution steps, see [docs/security/audit.md](docs/security/audit.md). We take the security of this project seriously. This document outlines our vulnerability disclosure process, scope, and SLAs. ## Reporting a Vulnerability diff --git a/contracts/Cargo.toml b/contracts/Cargo.toml index f278591..dd9c8ec 100644 --- a/contracts/Cargo.toml +++ b/contracts/Cargo.toml @@ -11,6 +11,7 @@ resolver = "2" [workspace.dependencies] soroban-sdk = "23" +ethnum = "1.5.3" [profile.release] overflow-checks = true diff --git a/contracts/deny.toml b/contracts/deny.toml new file mode 100644 index 0000000..5f133ed --- /dev/null +++ b/contracts/deny.toml @@ -0,0 +1,37 @@ +[advisories] +vulnerability = "deny" +unmaintained = "transitive" +notice = "warn" +ignore = [] + +[licenses] +unlicensed = "deny" +allow = [ + "MIT", + "Apache-2.0", + "Unicode-3.0", + "Unicode-DFS-2016", + "BSD-2-Clause", + "BSD-3-Clause", + "ISC", + "CC0-1.0", + "Zlib", + "0BSD", + "WTFPL", + "MPL-2.0", +] +confidence-threshold = 0.8 + +[bans] +multiple-versions = "warn" +wildcards = "allow" +highlight = "all" +deny = [] +skip = [] +skip-tree = [] + +[sources] +unknown-registry = "warn" +unknown-git = "warn" +allow-registry = ["https://github.com/rust-lang/crates.io-index"] +allow-git = [] diff --git a/deny.toml b/deny.toml new file mode 100644 index 0000000..5f133ed --- /dev/null +++ b/deny.toml @@ -0,0 +1,37 @@ +[advisories] +vulnerability = "deny" +unmaintained = "transitive" +notice = "warn" +ignore = [] + +[licenses] +unlicensed = "deny" +allow = [ + "MIT", + "Apache-2.0", + "Unicode-3.0", + "Unicode-DFS-2016", + "BSD-2-Clause", + "BSD-3-Clause", + "ISC", + "CC0-1.0", + "Zlib", + "0BSD", + "WTFPL", + "MPL-2.0", +] +confidence-threshold = 0.8 + +[bans] +multiple-versions = "warn" +wildcards = "allow" +highlight = "all" +deny = [] +skip = [] +skip-tree = [] + +[sources] +unknown-registry = "warn" +unknown-git = "warn" +allow-registry = ["https://github.com/rust-lang/crates.io-index"] +allow-git = [] diff --git a/docs/security/audit.md b/docs/security/audit.md new file mode 100644 index 0000000..28c6f30 --- /dev/null +++ b/docs/security/audit.md @@ -0,0 +1,47 @@ +# Dependency Security & Audit Policy + +## Overview + +Orivex smart contracts custody user funds and execute financial logic on the Soroban/Stellar network. Supply-chain security is critical to prevent vulnerabilities, malicious code injection, or unauthorized license usage across workspace dependencies. + +This document outlines the automated dependency security checks and policy enforced in CI. + +--- + +## Tooling & Verification + +### 1. `cargo-audit` +- **Purpose**: Scans `Cargo.lock` against the RustSec Advisory Database. +- **Enforcement**: Any crate with an unmitigated vulnerability marked as `deny` will cause CI build failure. +- **Local Execution**: + ```bash + cd contracts + cargo audit + ``` + +### 2. `cargo-deny` +- **Purpose**: Enforces license compliance, dependency bans, advisory checking, and crate source restrictions configured in `deny.toml`. +- **Policy Configuration**: Defined in `deny.toml` at workspace root. + - **Advisories**: Vulnerabilities result in immediate build denial. + - **Licenses**: Allowlist restricted to permissive open-source licenses (`MIT`, `Apache-2.0`, `Unicode-3.0`, `BSD-2-Clause`, `BSD-3-Clause`, `ISC`, `CC0-1.0`, `Zlib`, `WTFPL`). + - **Bans**: Warns on duplicate crate versions; disallows unverified crate origins. +- **Local Execution**: + ```bash + cd contracts + cargo deny check + ``` + +--- + +## Continuous Integration Trigger Schedule + +The security audit workflow (`.github/workflows/audit.yml`) executes under the following conditions: +1. **Push**: Every push targeting `main` or `develop`. +2. **Pull Requests**: Every open, synchronized, or reopened PR targeting `main` or `develop`. +3. **Scheduled Scan**: Weekly automated cron job (`0 0 * * 0`) to catch newly disclosed vulnerabilities in existing dependencies. + +--- + +## Advisory Waivers & Exception Process + +If an advisory warning is a false positive or does not impact contract safety (e.g. build-only tool dependency), temporary waivers must be explicitly recorded in `deny.toml` under `[advisories.ignore]` with a clear rationale, issue reference, and expiry plan.